@tekmidian/pai@0.54.1

PAI Knowledge OS — Personal AI Infrastructure with federated memory and project management

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The manifest has no npm install lifecycle hook, and inspected behavior aligns with setup, session handling, and opt-in notifications. Scanner indicators did not establish an active attack surface.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Explicit setup commands or a hook invocation with NTFY_TOPIC set.

Impact

No credential theft, unconsented install-time mutation, or other concrete attack impact was established.

Mechanism

Setup prompts before updating existing configuration; the notification hook posts its message to ntfy.sh using the configured topic.

AI rationale

The manifest has no npm install lifecycle hook, and inspected behavior aligns with setup, session handling, and opt-in notifications. Scanner indicators did not establish an active attack surface.

Network endpoints1

ntfy.sh

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json defines only a prepublishOnly build hook; it has no preinstall, install, or postinstall hook.
The setup command asks before updating an existing CLAUDE.md and backs up custom content first.
The project-context hook sends notifications to ntfy.sh only when NTFY_TOPIC is configured; it does not send credentials.
The flagged cleanup hook archives session files within the Claude project directory.
The inspected config, hook, runtime, and server paths show PAI or Claude configuration and session handling, with no confirmed malicious behavior.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 172 file(s), 4.68 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.example.com, api.kimi.ai, api.openai.com, api.todoist.com, api.z.ai, app.todoist.com, github.com, json-schema.org, ntfy.sh, www.apple.com

Source & flagged code

13 flagged

dist/run-DLG25bzt.mjsView file

Lines 1-26javascript

1import { n as openRegistry, r as registryDbPath } from "./db-Ddns80yf.mjs";

2import { C as readWorkersSection, E as resolveProviderKey, S as providerKeyPath, T as resolveModelCapability, _ as isModelCapability, d as WorkersConfigError, f as assertProviderRunnable, p as classModelCapability } from "./config-B3EPzRjf.mjs";

3import { _ as ledgerPath, a as claudeCommand, b as workersLogDir, c as isQuotaFailure, f as resolveCapabilityRun, g as eventsPath, h as ensureNoMcpConfig, i as buildRunEnv, l as nextAutoProvider, m as setCooldown, n as ensureProxyRunning, o as capabilityForRun, p as resolveTarget, t as DEFAULT_PROXY_PORT, v as panesDir, y as statusPath }

4import { appendFileSync, closeSync, existsSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";

5import { homedir, tmpdir } from "node:os";

6import { dirname, isAbsolute, join, relative, resolve } from "node:path";

7import { execFileSync, spawn } from "node:child_process";

8import { connect, createServer } from "node:net";

High

Child Process

Package source references child process execution.

dist/run-DLG25bzt.mjsView on unpkg · L6

9import { createInterface } from "node:readline";

11//#region src/workers/mcp.ts

12/**

13* mcp.ts — the MCP allowlist for headless workers.

14*

15* Headless workers start with NO MCP servers: every server definition is a

16* prompt-time tool inventory the model pays to know, and a worker that only

17* reads and edits files needs none of it. A run may opt in with `--mcp

18* name[,name…]`, a role carrying `"mcp": [...]`, or implicitly by naming

19* `mcp__server__tool` in --allowedTools (a grant without its server loaded is

20* a dead letter). Names may be single servers from ~/.claude.json's

21* `mcpServers` or `workers.mcpSets` set names, which expand to their member

22* list. The filtered config lands in

23* `<logDir>/<id>.mcp.json` and is passed with `--strict-mcp-config

24* --mcp-config` so exactly those servers load. MCP servers are chosen at

25* launch only — a mid-run `say` cannot add any.

26*

dist/program-B3eRMhff.mjsView file

4405], L4406: shell: true L4407: });

High

Shell

Package source references shell execution.

dist/program-B3eRMhff.mjsView on unpkg · L4405

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/program-B3eRMhff.mjs: import { appendFileSync, chmodSync, copyFileSync, cpSync, createReadStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, sta... import { createInterface } from "node:readline"; * 08 - Others/MDF/Infrastruktur/.claude/worktrees/cool-haibt 1 session * 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions fragment: `${sep}.claude${sep}worktrees${sep}`, writeFileSync(join(targetPath, "Notes", "MEMORY.md"), memoryContent, "utf-8"); const claudeProjects = join(homedir(), ".claude", "projects"); writeFileSync(configPath, JSON.strin

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/program-B3eRMhff.mjsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. l.template.md"); if (!existssync(templatepath)) { console.log(c.warn("skill template not found: " + templatepath)); console.log(c.dim(" skipping pai skill installation.")); return false; } const skilldir = join(homedir(), ".claude", "skills", "pai"); const skillfile = join(skilldir, "skill.md"); if (existssync(skillfile)) { const content = readfilesync(skillfile, "utf-8"); const isgenerated = content.includes("generated by pai setup"); if (isgenerated) console.log(c.dim(" found existing pai-generated skill.md.")); else { console.log(c.yellow(" found existing skill.md (not pai-generated).")); console.log(c.dim(" a backup will be created before overwri

dist/daemon-mcp/index.mjsView file

Lines 126-166javascript

126 configurable: true

127 });

128}

129function mergeDefs(...defs) {

130 const mergedDescriptors = {};

131

scripts/build-docs.mjsView file

Lines 315-355javascript

315

316 out.push("## All commands", "");

317 out.push("| Command | Description |", "|---------|-------------|");

318 for (const c of flat) {

dist/hooks/load-project-context.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2import { createRequire as __paiCreateRequire } from 'node:module';

3const require = __paiCreateRequire(import.meta.url);

4if (!

dist/hooks/cleanup-session-files.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: import { existssync as existssync2, mkdirsync, readdirsync, linksync, copyfilesync } from "fs"; import { join as join2, basename } from "path"; import { homedir } from "os"; import { resolve, join } from "path"; import { existssync, readfilesync } from "fs"; function loadenvfile() { const possiblepaths = [ resolve(process.env.adapter_dir || process.env.pai_dir || "", ".env"), resolve(homedir(), ".claude", ".env") ]; for (const envpath of possiblepaths) { if (existssync(envpath)) { try { const content = readfilesync(envpath, "utf-8"); for (const line of content.split("\n")) { const trimmed = line.trim(); if (

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/hooks/cleanup-session-files.mjsView on unpkg

tab-color-command.shView file

•path = tab-color-command.sh kind = build_helper sizeBytes = 860 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tab-color-command.shView on unpkg

dist/server-CGiHdaUp.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/server-CGiHdaUp.mjs#virtual:normalized:round1View on unpkg

Source & flagged code

13 flagged · loading source

dist/run-DLG25bzt.mjsView file

6import { dirname, isAbsolute, join, relative, resolve } from "node:path"; L7: import { execFileSync, spawn } from "node:child_process"; L8: import { connect, createServer } from "node:net";

High

Child Process

Package source references child process execution.

dist/run-DLG25bzt.mjsView on unpkg · L6

dist/program-B3eRMhff.mjsView file

4405], L4406: shell: true L4407: });

High

Shell

Package source references shell execution.

dist/program-B3eRMhff.mjsView on unpkg · L4405

Findings

1 Critical9 High6 Medium5 Low

CriticalCredential Exfiltrationdist/hooks/load-project-context.mjs

HighChild Processdist/run-DLG25bzt.mjs

HighShelldist/program-B3eRMhff.mjs

HighEvaldist/daemon-mcp/index.mjs

HighCredential Redirect Persistencedist/program-B3eRMhff.mjs

HighExternal Ai Agent Control Surface Mutationdist/hooks/cleanup-session-files.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/program-B3eRMhff.mjs

HighCross File Remote Execution Contextdist/program-B3eRMhff.mjs

HighTrigger Reachable Persistencedist/program-B3eRMhff.mjs

HighSemantic Analysis Limiteddist/server-CGiHdaUp.mjs#virtual:normalized:round1

Affected versions and remediation

This report applies to @tekmidian/pai@0.54.1.

See all versions of @tekmidian/pai for other recorded verdicts.

Review the evidence and your use of @tekmidian/pai@0.54.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 18:27:59.470Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.